refactor: unify onboarding dm/group policy scaffolding

src/channels/plugins/onboarding/helpers.test.ts

@@ -27,6 +27,9 @@ import {
   setAccountAllowFromForChannel,
   setAccountGroupPolicyForChannel,
   setChannelDmPolicyWithAllowFrom,
+  setTopLevelChannelAllowFrom,
+  setTopLevelChannelDmPolicyWithAllowFrom,
+  setTopLevelChannelGroupPolicy,
   setLegacyChannelAllowFrom,
   setLegacyChannelDmPolicyWithAllowFrom,
   setOnboardingChannelEnabled,
@@ -913,6 +916,73 @@ describe("setChannelDmPolicyWithAllowFrom", () => {
   });
 });
 
+describe("setTopLevelChannelDmPolicyWithAllowFrom", () => {
+  it("adds wildcard allowFrom for open policy", () => {
+    const cfg: OpenClawConfig = {
+      channels: {
+        zalo: {
+          dmPolicy: "pairing",
+          allowFrom: ["12345"],
+        },
+      },
+    };
+
+    const next = setTopLevelChannelDmPolicyWithAllowFrom({
+      cfg,
+      channel: "zalo",
+      dmPolicy: "open",
+    });
+    expect(next.channels?.zalo?.dmPolicy).toBe("open");
+    expect(next.channels?.zalo?.allowFrom).toEqual(["12345", "*"]);
+  });
+
+  it("supports custom allowFrom lookup callback", () => {
+    const cfg: OpenClawConfig = {
+      channels: {
+        "nextcloud-talk": {
+          dmPolicy: "pairing",
+          allowFrom: ["alice"],
+        },
+      },
+    };
+
+    const next = setTopLevelChannelDmPolicyWithAllowFrom({
+      cfg,
+      channel: "nextcloud-talk",
+      dmPolicy: "open",
+      getAllowFrom: (inputCfg) =>
+        (inputCfg.channels?.["nextcloud-talk"]?.allowFrom ?? []).map((entry) => String(entry)),
+    });
+    expect(next.channels?.["nextcloud-talk"]?.allowFrom).toEqual(["alice", "*"]);
+  });
+});
+
+describe("setTopLevelChannelAllowFrom", () => {
+  it("writes allowFrom and can force enabled state", () => {
+    const next = setTopLevelChannelAllowFrom({
+      cfg: {},
+      channel: "msteams",
+      allowFrom: ["user-1"],
+      enabled: true,
+    });
+    expect(next.channels?.msteams?.allowFrom).toEqual(["user-1"]);
+    expect(next.channels?.msteams?.enabled).toBe(true);
+  });
+});
+
+describe("setTopLevelChannelGroupPolicy", () => {
+  it("writes groupPolicy and can force enabled state", () => {
+    const next = setTopLevelChannelGroupPolicy({
+      cfg: {},
+      channel: "feishu",
+      groupPolicy: "allowlist",
+      enabled: true,
+    });
+    expect(next.channels?.feishu?.groupPolicy).toBe("allowlist");
+    expect(next.channels?.feishu?.enabled).toBe(true);
+  });
+});
+
 describe("splitOnboardingEntries", () => {
   it("splits comma/newline/semicolon input and trims blanks", () => {
     expect(splitOnboardingEntries(" alice, bob \ncarol;  ;\n")).toEqual(["alice", "bob", "carol"]);

src/channels/plugins/onboarding/helpers.ts

@@ -161,6 +161,75 @@ export function setAccountAllowFromForChannel(params: {
   });
 }
 
+export function setTopLevelChannelAllowFrom(params: {
+  cfg: OpenClawConfig;
+  channel: string;
+  allowFrom: string[];
+  enabled?: boolean;
+}): OpenClawConfig {
+  const channelConfig =
+    (params.cfg.channels?.[params.channel] as Record<string, unknown> | undefined) ?? {};
+  return {
+    ...params.cfg,
+    channels: {
+      ...params.cfg.channels,
+      [params.channel]: {
+        ...channelConfig,
+        ...(params.enabled ? { enabled: true } : {}),
+        allowFrom: params.allowFrom,
+      },
+    },
+  };
+}
+
+export function setTopLevelChannelDmPolicyWithAllowFrom(params: {
+  cfg: OpenClawConfig;
+  channel: string;
+  dmPolicy: DmPolicy;
+  getAllowFrom?: (cfg: OpenClawConfig) => Array<string | number> | undefined;
+}): OpenClawConfig {
+  const channelConfig =
+    (params.cfg.channels?.[params.channel] as Record<string, unknown> | undefined) ?? {};
+  const existingAllowFrom =
+    params.getAllowFrom?.(params.cfg) ??
+    (channelConfig.allowFrom as Array<string | number> | undefined) ??
+    undefined;
+  const allowFrom =
+    params.dmPolicy === "open" ? addWildcardAllowFrom(existingAllowFrom) : undefined;
+  return {
+    ...params.cfg,
+    channels: {
+      ...params.cfg.channels,
+      [params.channel]: {
+        ...channelConfig,
+        dmPolicy: params.dmPolicy,
+        ...(allowFrom ? { allowFrom } : {}),
+      },
+    },
+  };
+}
+
+export function setTopLevelChannelGroupPolicy(params: {
+  cfg: OpenClawConfig;
+  channel: string;
+  groupPolicy: GroupPolicy;
+  enabled?: boolean;
+}): OpenClawConfig {
+  const channelConfig =
+    (params.cfg.channels?.[params.channel] as Record<string, unknown> | undefined) ?? {};
+  return {
+    ...params.cfg,
+    channels: {
+      ...params.cfg.channels,
+      [params.channel]: {
+        ...channelConfig,
+        ...(params.enabled ? { enabled: true } : {}),
+        groupPolicy: params.groupPolicy,
+      },
+    },
+  };
+}
+
 export function setChannelDmPolicyWithAllowFrom(params: {
   cfg: OpenClawConfig;
   channel: "imessage" | "signal" | "telegram";